_Delete_ExMark@4
_Insert_ExMark@8
Static task
static1
Target
2b5af093f8d1ca615b0b43e9efc7de13_JaffaCakes118
Size
30KB
MD5
2b5af093f8d1ca615b0b43e9efc7de13
SHA1
2657a294afbfc62000e13c999608d5d48e55a032
SHA256
6b50737347726163d581f8643e6404c25075fd49e4b0c9642f201df22b052097
SHA512
63fb8cfd4027e0165077c7f8f20c8da2fc60fcc32f35d09d8094e6883cfe33b60a0edf5e416888ccbe881a056a65fafdb9d52e9b50c35111e52551940d1d7f4e
SSDEEP
768:MtUKyHWd1iFmJqsrNGfn6ZouUQGMYSuLL:MtUT2OSNGfnAoS0
Checks for missing Authenticode signature.
resource |
---|
2b5af093f8d1ca615b0b43e9efc7de13_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
ExFreePoolWithTag
ExReleaseResourceForThreadLite
ExConvertExclusiveToSharedLite
ExAcquireSharedWaitForExclusive
ExAllocatePool
ExReleaseResourceLite
ExSetResourceOwnerPointer
ObGetObjectSecurity
VerSetConditionMask
ZwQuerySymbolicLinkObject
strstr
RtlIntegerToUnicodeString
wcsncpy
ZwCreateDirectoryObject
ZwPowerInformation
RtlUnicodeStringToAnsiString
ZwDeleteValueKey
RtlInitString
wcsncat
RtlCompareString
ZwSetInformationFile
wcsstr
ZwEnumerateValueKey
RtlAppendUnicodeStringToString
RtlFreeAnsiString
ZwDeleteFile
IoAllocateIrp
ZwOpenProcess
RtlCopyUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
wcsncmp
ZwQueryInformationFile
ZwOpenSection
ObReferenceObjectByPointer
RtlSplay
memset
_Delete_ExMark@4
_Insert_ExMark@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ